PRD-03: Curated native dapp integrations (Phase 0) #47

Part of #44 (ADR 0001). Phase 0. "Curated/allowlisted dapps first" realized as native Deckard surfaces — no browser, no extension, no relay, no external proposer. First user-visible value and the most secure reading of "connect to dapps."

Why

The most secure form of the curated set needs no generic dapp-connection transport: each integration is a native screen building a typed Intent/SwapOrder in Rust through the existing daemon → policy → clear-signing path — exactly how Shield (Railgun) and the CoW swap path already work (swap_order.rs, SignOrder). Zero new attack surface, on-brand ("calm sovereign control, not a casino"), offline-first, ships before PRD-04/05.

Goals

• A small vetted set as native surfaces, each producing a typed proposal. Initial: token swap (extend existing) + one bridge. Each is a wallet action, ⌘K-reachable, clear-signed on confirm.
• A curated integration registry in-repo (compile-time or signed config): allowed protocols, contract addresses per chain, the IntentKind/order they build. The "allowlist" = code paths we shipped, not URLs.
• Reuse Policy.allow_swap_tokens/allow_to fences; no new bypass.

Non-goals

Generic/open dapp access (PRD-04, the Deckard-native bridge) — no window.ethereum, no external transport here, native Rust only. Per-origin permissions (PRD-05) — there is no untrusted origin. New signing primitives beyond PRD-02 (a swap needs Permit2/EIP-712 → PRD-02's job; this consumes it).

Design

Each integration: (1) fetch quote/route over the verified-read/RPC path (reads only); (2) build a typed Intent/SwapOrder against registry-pinned addresses for the active chain_id; (3) Propose/ProposeOrder → clear-signing card → on hold-confirm Execute/SignOrder. Daemon calldata_ok + evaluate/evaluate_order fences apply unchanged — typed builders only, never raw arbitrary calldata.

Registry: versioned in-repo JSON (const/include_str!, offline-first). If updatable without a release, signed — verify a maintainer signature before trust; never an unsigned downloaded allowlist. Off-registry targets are impossible from this surface (would need a reviewed code change).

UI (DESIGN.md): swap extends Amount-input + Clear-signing-card; bridge is a new wallet action (Send/Receive/Swap sibling) showing source chain, dest chain, dest address, asset — danger-early on mismatch; same status-glyph activity rows.

Acceptance tests

swap_builds_pinned_addresses; bridge_proposal_clear_signs; off_registry_denied; existing swap_parity.rs stays green; registry signature check rejects tampered/unsigned loudly (mirror policy_store.rs loud-fallback).

DoD

Shared DoD (#44) plus: each integration is a ⌘K Command; registry + trust model documented; bridge card matches DESIGN.md (screenshot in PR).

Risks

Protocol APIs are untrusted input → daemon still validates the typed proposal against pinned addresses + policy; never sign what the API returns verbatim. Bridge complexity (two chains) → pick one well-understood bridge, honest pending/failed states. Resist scope creep toward "open any dapp" (that's PRD-04, audit-gated).

Sources: ADR 0001 Phase 0; existing swap_order.rs, SignOrder, swap_parity.rs, Railgun Shield (docs/build/10-kohaku-shield.md); DESIGN.md.